System and method for managing security key architecture in multiple security contexts of a network environment
View Patent ↗A user equipment (UE) device that is able to engage in multiple security contexts contains a key generator to generate one or more authentication keys for authentication of the UE device in a particular security context and a component configured to facilitate storing of the authentication keys in a subscriber identity module (SIM) if an elementary file (EF) structure for the particular security context is available in the SIM and to facilitate storing of the authentication keys in a nonvolatile memory (NVM) of the UE device if the EF structure is not found in the SIM.
1. A multiple security context management method for use on a mobile equipment, said method comprising:
responsive to receiving a first challenge from a first, packet-switched, network pursuant to a first security context requesting a removable subscriber identity module (SIM) for generating a first set of authentication vectors with respect to said first security context, receiving said first set of authentication vectors and storing said first set of authentication vectors in a first location on one of said mobile equipment and said subscriber identity module, said first location being associated with said first security context;
responsive to receiving a second challenge from a second, circuit-switched, network pursuant to a second security context in order to receive circuit-switched services via said first network, requesting said removable subscriber identity module for generating a second set of authentication vectors with respect to said security context, receiving said second set of authentication vectors and storing said second set of authentication vectors in a second location on one of said mobile equipment and said subscriber identity module, said second location being associated with said second security context; and
responsive to preparation for transferring access for said mobile equipment from said first network to said second network, receiving a security mode command message from a network node coupled to said second network and determining that said second set of authentication vectors should be used instead of said first set of authentication vectors for handover from said first network to said second network.
2. The method of claim 1 , wherein said first security context is one of a Long Term Evolution (LTE) Enhanced Packet Core (EPC) context and an IP Security Tunnel context.
3. The method of claim 1 , wherein said second security context is a GERAN/UTRAN security context.
4. The method of claim 1 , wherein said first location is provided on said removable SIM.
5. The method of claim 1 , wherein said first location is provided as a memory integrated within said mobile equipment.
6. The method of claim 1 , wherein said second location is provided on said removable SIM.
7. The method of claim 1 , wherein said second location is provided as a memory integrated within said mobile equipment.
8. The method of claim 1 , wherein said determining that said second set of authentication vectors should be used instead of said first set of authentication vectors is for a VoLGA to UTRAN handover.
9. The method of claim 1 , wherein said determining that said second set of authentication vectors should be used instead of said first set of authentication vectors is performed when accessing Teleservices of said second network over said first network is to be switched over to accessing said Teleservices over said second network.
10. A mobile equipment, comprising:
a micro-processor operably coupled to a communication subsystem and to a memory containing instructions that when executed by the micro-processor perform the following:
responsive to receiving a first challenge from a first, packet-switched, network pursuant to a first security context, requesting a removable subscriber identity module (SIM) for generating a first set of authentication vectors with respect to said first security context, receiving said first set of authentication vectors and storing said first set of authentication vectors in a first location on one of said mobile equipment and said subscriber identity module, said first location being associated with said first security context;
responsive to receiving a second challenge from a second, circuit-switched, network pursuant to a second security context in order to receive circuit-switched services via said first network, requesting said removable subscriber identity module for generating a second set of authentication vectors with respect to said security context, receiving said second set of authentication vectors, and storing said second set of authentication vectors in a second location on one of said mobile equipment and said subscriber identity module, said second location being associated with said second security context; and
responsive to preparation for transferring access for said mobile equipment from said first network to said second network, receiving a security mode command message from a network node coupled to said second network and determining that said second set of authentication vectors should be used instead of said first set of authentication vectors for handover from said first network to said second network.
11. The mobile equipment of claim 10 , wherein said first security context is one of a Long Term Evolution (LTE) Enhanced Packet Core (EPC) context and an IP Security Tunnel context.
12. The mobile equipment of claim 10 , wherein said second security context is a GERAN/UTRAN security context.
13. The mobile equipment of claim 10 , wherein said first location is provided on said removable SIM.
14. The mobile equipment of claim 10 , wherein said first location is provided as a memory integrated within said mobile equipment.
15. The mobile equipment of claim 10 , wherein said second location is provided on said removable SIM.
16. The mobile equipment of claim 10 , wherein said second location is provided as a memory integrated within said mobile equipment.
17. The mobile equipment of claim 10 , wherein said determining that said second set of authentication vectors should be used instead of said first set of authentication vectors is for a VoLGA to UTRAN handover.
18. The mobile equipment of claim 10 , wherein said determining that said second set of authentication vectors should be used instead of said first set of authentication vectors is performed when accessing Teleservices of said second network over said first network is to be switched over to accessing said Teleservices over said second network.
19. A user equipment (UE) device, comprising:
a micro-processor operably coupled to a communication subsystem and to a memory containing instructions that when executed by the micro-processor perform the following:
generating one or more authentication keys for authentication of said UE device in a particular security context with a network node, said particular security context relating to one of a legacy circuit-switched context and an IPSec Tunnel context; and
determining whether a subscriber identity module (SIM) attached to said UE device contains an elementary file (EF) structure for said particular security context, facilitating storage of said authentication keys in said SIM when an elementary file (EF) structure for said particular security context is available in said SIM, and facilitating storage of said authentication keys in a nonvolatile memory (NVM) of said UE device when said EF structure is not found in said SIM.
20. The US device of claim 19 , wherein said particular security context is a Long Term Evolution (LTE) Enhanced Packet Core (EPC) context and said network node comprises a Mobile Management Entity (MME) node.
21. The UE device of claim 19 , wherein said particular security context is an IP Security Tunnel context established for accessing a circuit-switched service and said network node comprises a generic access network controller (GANC).
22. The UE device of claim 21 , wherein said circuit-switched service is a voice service over LTE via Generic Access (VoLGA) and said GANC comprises a VoLGA access network controller (VANC).
23. The UE device of claim 19 , wherein said particular security context is a GSM/EDGE Radio Access Network (GERAN) context accessed via a packet-switched network and said network node comprises a GSM-compliant mobile switching center (MSC) serving said UE device.
24. The UE device of claim 19 , wherein said particular security context is a Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN) context accessed via a packet-switched network and said network node comprises a UMTS-compliant mobile switching center (MSC) serving said UE device.
25. The UE device of claim 19 , wherein said one or more authentication keys comprise at least one of a UTRAN Ciphering Key (Ck), an Integrity Key (Ik), a GSM Ciphering Key (Kc) and an Access Security Management Entity (ASME) Key (KASME).
26. The UE device of claim 19 , wherein said EF structure is adapted to contain keys for multiple security contexts.
27. The UE device of claim 26 , wherein said multiple security contexts comprise an LTE EPC context, an IP Secure Tunnel context, a GERAN context and a UTRAN context.
28. The UE device of claim 19 , wherein said instructions when executed by said microprocessor further perform interrogating said SIM responsive to one or more authentication inputs depending on access technologies used by said UE device.